I've run across this cisco advisory
This bug was introduced in Cisco IOS XR Software release 3.6.2 and is fixed with SMU hfr-k9sec-3.6.2.CSCtd74795. The SMU ID for this fix in 3.6.2 is AA03656. This vulnerability has been fixed in 3.8.3, 3.9.1, and 4.0.0 for customers running later software versions. Software version 3.7 is not affected by this vulnerability.
I'm trying to figure out something, according to this, 3.6.2 is vulnerable unless fixed with the mentioned SMU.
What about versions such as:
- 3.5.4 and earlier... are they also vulnerable?
Also, it says it was fixed in 3.8.3 and 3.9.1, why do they also mention 3.9.1, isnt 3.9.1 > 3.8.3 so its obvious that it is also fixed in 3.9.1?